ALE (Annualised Loss Expectancy)
Definition
The expected monetary loss from a specific threat over a one-year period. Calculated as: ALE = SLE x ARO (Annualised Rate of Occurrence). ALE is the primary metric used to justify control investments in quantitative risk analysis.
- Formula
- ALE = SLE x ARO
- SLE meaning
- Single Loss Expectancy
- ARO meaning
- Annualised Rate of Occurrence
- Primary use
- Justifying security control investment in quantitative risk analysis
Common questions
How is ALE actually used to decide whether a security control is worth buying?+
An organisation compares the ALE reduction a control would achieve against its annual cost, since a control that costs more than the loss it prevents fails a basic cost-benefit test even if it addresses a real threat.
What is the main weakness of relying on ALE for decision-making?+
Both SLE and ARO are frequently estimates rather than measured values, particularly for rare but severe events, so an ALE figure can carry substantial uncertainty while presenting itself as a precise single number to decision makers.
Related terms
- FAIR (Factor Analysis of Information Risk)
- A quantitative risk framework standardised by The Open Group (Open FAIR) that decomposes risk into Loss Event Frequency and Loss Magnitude, each...
- Qualitative Risk Assessment
- A methodology that rates likelihood and impact on descriptive or ordinal scales (such as 1-5 or low/medium/high) and combines them in a...
- Quantitative Risk Assessment
- A methodology that assigns monetary values to threat scenarios using metrics such as asset value, exposure factor, SLE, ARO, and ALE. Outputs...
- Risk Appetite
- The amount and type of risk an organisation is willing to accept in pursuit of its objectives, as defined by its governing...
- SLE (Single Loss Expectancy)
- The expected monetary loss from a single occurrence of a specific threat event against a specific asset. Calculated as: SLE = Asset...